Many private instances open large numbers of concurrent connections through one public NAT gateway to the same external destination IP and port. The NAT gateway ErrorPortAllocation metric rises while destination and route checks pass. Which cause should operations investigate first?

1. Exhaustion of available NAT source-port allocations for that destination, followed by supported capacity or connection-reuse changes.
2. A missing default route from the private subnet, despite the verified route checks.
3. A DNS lookup failure that is corrected solely by increasing the DNS record TTL.
4. A subnet ACL deny that can be fixed by increasing the NAT idle timeout.